Replace magic `_createdAt` loaded-sentinel with `Project#isLoaded` getter

## Context

`utilities/projectReady.js` checks `TPEN.activeProject?._createdAt` as a proxy for "the active project is fully loaded":

https://github.com/CenterForDigitalHumanities/TPEN-interfaces/blob/main/utilities/projectReady.js

```javascript
if (TPEN.activeProject?._createdAt) {
bound()
}
```

`_createdAt` is a server-populated field — its presence happens to imply the project has been fetched, but the coupling is implicit and undocumented. If the server field is ever renamed or removed, both `onProjectReady` and `whenProjectReady` silently regress to "never invoke synchronously" without any test failure.

## Proposal

`Project.js` already tracks loaded state internally:

```javascript
this.#isLoaded = true
eventDispatcher.dispatch("tpen-project-loaded", this)
```

Expose a public `get isLoaded()` getter and switch the sentinel check to:

```javascript
if (TPEN.activeProject?.isLoaded) {
// ...
}
```

### Why this is better

- Removes the magic / undocumented dependency on a server field name.
- The "loaded" state is owned by the thing that is loaded, not inferred from a co-occurring server property.
- Survives schema changes to the project payload.
- Self-documenting at the call site.

## Scope

- Add `get isLoaded()` to `Project.js` returning `#isLoaded`.
- Update the two checks in `utilities/projectReady.js` (`onProjectReady`, `whenProjectReady`).
- Update `utilities/__tests__/projectReady.test.js` — replace `_createdAt: Date.now()` setup with `isLoaded: true` (or a real `Project` instance).

## Related

- Surfaced during review of #568 (the load-race fix).
- Out of scope for #568 to keep that PR focused on the race condition.